Cybersecurity GRC Analyst

1. 1
   Build Security Fundamentals — CompTIA Security+

   CompTIA Security+ ($392 exam) is the baseline credential for all cybersecurity paths. It covers: threats and vulnerabilities, security architecture, identity management, cryptography basics, and incident response. Professor Messer's free Security+ course and Jason Dion's Udemy practice exams are the standard prep resources. Security+ is also DoD 8570 approved for government cybersecurity positions.

   CompTIA Security+ — baseline credential
2. 2
   Learn Risk and Compliance Frameworks

   GRC analysts work within specific frameworks. Core frameworks to study: NIST Cybersecurity Framework (CSF) — the most widely adopted US cybersecurity framework; ISO 27001 — the international information security management standard; SOC 2 — the audit standard for service organizations handling customer data; NIST RMF (Risk Management Framework) — required for federal systems; PCI-DSS — payment card industry standard; HIPAA — healthcare data protection. Each framework has free documentation from its issuing body.

   NIST CSF + ISO 27001 + SOC 2 frameworks
3. 3
   Earn CompTIA CASP+ or CISA for Risk/Audit Track

   CISA (Certified Information Systems Auditor, $760 for ISACA members) is the premier credential for IT audit and compliance roles. It covers: IS audit processes, IT governance, systems acquisition, IT operations, and information asset protection. Requires 5 years of IS audit experience (reduced by education). For candidates without the experience: CompTIA CASP+ ($495) validates advanced security concepts and is achievable with less experience.

   CISA (audit track) or CASP+ (security track)
4. 4
   Develop Policy Writing and Risk Assessment Skills

   The core GRC analyst deliverables: security policy documentation (acceptable use, access control, incident response, data classification policies), risk assessments (identifying, evaluating, and prioritizing security risks), control gap analysis (comparing current controls to framework requirements), and audit evidence collection. Practice: download NIST SP 800-53 (the comprehensive security controls catalog) and practice mapping controls to a hypothetical organization's environment.

   Security policy writing + risk assessment methodology
5. 5
   Pursue CISM for Management Track

   CISM (Certified Information Security Manager, $760 for ISACA members) is the senior GRC credential — the highest salary premium in the ISACA certification family. Covers: information security governance, risk management, program development, and incident management. Requires 5 years of IS management experience. CISM holders are among the highest-compensated information security professionals and frequently advance to CISO (Chief Information Security Officer) roles.

   CISM — ISACA Certified Information Security Manager

• 9:00 AMSOC 2 audit prep — external auditors arrive in 3 weeks. Review the evidence request list: 47 items. Status check: 31 collected, 16 outstanding. Flag the 5 items that need IT team input — send reminder emails with the specific evidence format required.
• 10:30 AMVendor risk assessment — a new SaaS vendor wants to process customer PII. Complete the vendor risk questionnaire: review their SOC 2 Type II report (clean opinion, no exceptions), check their data processing agreement against our DPA template, assess their subprocessor list. Classify as Low Risk — approve with annual reassessment.
• 12:00 PMLunch — 30 minutes.
• 1:00 PMPolicy review — the access control policy is due for annual review. Update for the new cloud environment: add multi-factor authentication requirements for all cloud admin access, update the privileged access review cycle from quarterly to monthly per the new NIST guidance. Route to CISO for approval.
• 2:30 PMRisk register update — a new finding from last week's pen test: a critical vulnerability in a legacy system. Add to risk register: rate the impact (High — contains customer data) and likelihood (Medium — internal network only). Assign remediation owner and 30-day target. Flag as Board-reportable risk item.
• 4:00 PMNIST CSF gap analysis — mapping the current control environment against NIST CSF 2.0. Three new gaps identified in the Govern function (new in CSF 2.0). Document remediation recommendations for the quarterly risk committee report.

GRC (Governance, Risk, and Compliance) analysts navigate regulatory frameworks, manage organizational risk, and ensure compliance with evolving legal standards — a fundamentally human professional accountability function. The +35% growth reflects expanding regulatory complexity across all industries.